1. Chrome desktop: critical browser fixes (Critical)

CVE-2026-118306, CVE-2026-118331, CVE-2026-118348, CVE-2026-118344

Impact

Google’s 27 October desktop update includes Critical-rated memory-corruption, input-validation and use-after-free flaws in FileSystem, FileAPI, Skia and Layout. The linked identifiers are vendor-published; verified numeric CVSS scores were not available for this briefing. Google restricts some technical details while users update.

Remediation

Update Chrome to 156.0.8078.73/.74 on Windows and macOS, or 156.0.8078.73 on Linux, or a later fixed release. Check managed browser inventories and relaunch after updating; a downloaded update does not establish that the running browser is patched. Verify the installed version through Chrome’s About page or your management console.

Checks and IoCs

The release notice does not supply campaign-specific indicators or state that these four flaws are being actively exploited. Investigate suspicious browser or child-process activity through existing endpoint telemetry; those behaviours are hunting leads, not issue-specific proof of compromise.

Sources: Google desktop release, 27 October

2. PHP: new Zyxel exposure assessment (Critical)

CVE-2026-109618 (9.2), CVE-2026-109619 (9.2)

What changed

In its initial statement dated 28 October, Zyxel says no Zyxel products currently available on the market are affected by these two PHP vulnerabilities because they do not incorporate the vulnerable package. The Critical label describes the PHP flaws, not a finding that Zyxel devices are vulnerable.

Customer action

Use the vendor assessment when triaging Zyxel equipment. It does not establish the status of other manufacturers’ devices or independently hosted PHP applications. This is an exposure clarification, not a new PHP vulnerability or a new patch requirement for the Zyxel products covered by the statement. Continue normal vendor-supported maintenance.

Sources: Zyxel’s 28 October statement · PHP vulnerability ratings